| name | dual-instance-verification |
| description | Dual-instance (双机) real-machine verification protocol for ORG2 cloud sync and session sharing. Use before declaring any sharing/sync/collab feature or fix "verified": share/unshare, push/retract, fork/import, comments, member-floor, replay, continuation, or anything touching Org2CloudSyncEngine, collab engines, or the session channel pipeline. Also use when a sharing bug escaped earlier testing, to check which discipline below was skipped. |
Dual-Instance Verification (双机实测)
Real-machine verification of session sharing across ORG2 (primary, Neonforge) and
ORG2 Instance 2 (VantaNode). Born from a four-bug escape on 2026-07-24 where every
bug passed the old three-piece check (resource curves + feature signals +
WARN/ERROR delta). The disciplines below exist because each one, applied that day,
would have caught at least one escaped bug.
Core principle
Assert invariants, not absence of errors. A scenario passes only when the
positive end-state is proven on THREE surfaces — sender instance, receiver
instance, and the cloud rows — and every state mutation in between is explainable.
Non-negotiables
-
Cloud ground-truth ledger — fleet-wide, invariant-based. Snapshot
cloud_sessions (session_id, deleted_at, access_mode, events_count,
events_frozen_seq, events_epoch, stored_bytes) BEFORE and AFTER every
scenario, via service key — for EVERY org the instances can see, not just the
org under test. Diff must be explainable line-by-line, and "explainable"
means a verified mechanism, not a plausible story ("that session is active"
is a story; "its rollout grew by N lines, here they are" is a mechanism).
On top of the diff, assert invariants: for every session the scenario did
NOT deliberately touch, events_epoch is CONSTANT and events_count is
monotone; flag any row with events_epoch above a small threshold (>3)
anywhere in the fleet. Any unexplained deleted_at, access_mode downgrade,
events_count drop, or epoch bump is a FAILURE even if the UI looks fine.
(Would have caught: vanished-sweep mass retract, boot out-of-scope retract,
and the #608 rewrite storm — a 28-epoch counter sat in this column for weeks
while diffs on the test org alone stayed clean.)
